CVE-2024-22477: 
PingFederate vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability has been identified in the admin console OIDC Policy Management Editor of PingFederate (CVE-2024-22477). The vulnerability affects multiple versions of PingFederate including versions 10.3.0 through 10.3.13, 11.0.0 through 11.0.9, 11.1.0 through 11.1.9, 11.2.0 through 11.2.8, 11.3.0 through 11.3.4, and 12.0.0. The vulnerability was disclosed on July 9, 2024 (NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). According to the CVSS v3.1 scoring, the vulnerability has received two different assessments: NIST rates it as MEDIUM severity with a base score of 4.3 (CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), while Ping Identity Corporation rates it as LOW severity with a base score of 1.8 (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) (NVD).

The impact of this vulnerability is specifically contained to admin console users only. The vulnerability could potentially allow cross-site scripting attacks within the admin console OIDC Policy Management Editor (NVD).

The vulnerability requires adjacent network access (AV:A), high privileges (PR:H), and user interaction (UI:R) to be exploited. The complexity of exploitation varies between low and high according to different assessments (NVD).

Specific mitigation details are available in the vendor advisory documentation (Vendor Advisory).